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1.0 Introduction 


The Phase III version of CARE III (^omputer-Aided ^el iabil ity _Estimation, 

version three) is the product of a series of efforts designed to help estimate the 
reliability of complex redundant systems. Although designed specifically 

for use in fault-tolerant avionics systems, the approach is of a general nature 
and can be used to model a variety of redundant structures. 

The first CARE program developed at the Jet Propulsion Laboratory in 1971, 
provided an aid for estimating the reliability of systems consisting of a com- 
bination of any of several standard configurations (e.g,^ stand by - replacement 
configurations, triple modular redundant configurations, etc.). CARE II and CARE III 
were subsequently developed by Raytheon, under contract to the NASA Langley Re- 
search Center. CARE II substanti al ly generalized the class of redundant config- 
urations that could be accommodated, and included a coverage model to determine 
the various coverage probabi 1 ities as a function of the applicable fault recovery 

mechanism (detection delay, diagnostic scheduling interval, isolation and 
recovery delay, etc.). 

CARE III further generalized the class of system structures that can be modelled 
and greatly expands the coverage model to take into account such effects as 
intermittent and transient faults, latent faults, error propagation, etc. In 
order to accomplish this, it was necessary to depart substantially from the 
approaches taken in the earlier CARE efforts. The nature of, and reasons for, 

this departure are discussed in the CARE III PHASE II Report, Mathematical Descrip- 
tion, Section 2. This Phase III version of CARE III is a further refinement of 
the CARE III approach, with the current status of the program reported on here. 



2.0 INTENT OF PHASE III 


The third phase of the CARE III project has been oriented towards the eval- 
uation and refinement of the Phase II version of CARE III. Various stress tests, 
single and double fault, and various consistancy tests have been defined so as to 
test many of the assumptions and approximations used in the most recent version 
of the program. 

During the course of this evaluation a few inadequate numerical techniques 
or their improper implementations have become apparent. Most of these inadequacies 
have been corrected, although a few are beyond the scope of the current effort. 

All of the problems encountered, their severity and the corrective actions taken 
are addressed in this report. 

2.1 Selection of Test Cases 

Because CARE III is so versatile and the set of possible input conditions 
so large, it is difficult to test it and to verify its accuracy with any degree 
of completeness. The major emphasis of the current effort is to restrict the 

allowed set of input parameters to the point that other, independent, but much 
simpler models could be developed to verify at least some of the results produced 
by CARE III. This approach was particularly useful in testing coverage model 
results since these intermediate results had heretofore been tested only in- 
directly through their influence on reliability predictions. 

The specific test cases wore selected so as to minimize, in CARE III, all factors 

influencing unreliability except those that could be independently evaluated using 
these simple models. These latter models were then used to verify the coverage functions 
(e,g. Appendix 4 and Ref. 4) produced by CARE 

III under various choices of the remaining unrestricted parameters. These parameters 
were chosen specifically to stress the numerical analysis techniques 
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used in the CARE III coverage program, thereby attempting to expose any weak- 
nesses in these techniques. 

Other test cases, specifically, the FTMP and SIFT test cases, were 
selected because previous results were available for comparison, both indepen- 
dently derived results and results obtained using earlier versions of CARE III. 
These tests were useful in assessing the effect on CARE III of the modifications 
that have been introduced to improve its accuracy and to correct flaws discovered 

during the aforementioned tests. 
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2.2 Test Program Mathematical Model 


Verification of the single and double fault models and evaluation of the 
computational algorithms used in CARE III, was greatly enhanced by the use of two 
analytical test programs; SFMODL, and DFMODL. These two programs use a 

Markov mathematical model to calculate, for a restricted set of input cases, 
some of the intermediate single and double fault results. 

By restricting the input transition parameters to be time invarient, and 
allowing only constant rate functions the CARE III single fault (Figure I ) and 
double fault models (Figurell) can be programmed using standard Markov-model 
analysis techniques. 

In both cases the state diagram models are translated into matrix form as 
fol 1 ows : 

Single Fault Model Matrix 



A 

B 

^E 


A 

- ( a+p+P^ 6) 


(I-Pa)Ce 

0 

B 

a 

-3 

0 

0-Pb)Cs 

''e 

P 

0 

-(a+e) 

3 

Be 

0 

0 

a 

-(6+e) 


Double 

Fault 

Model Matrix 




B 1 A 2 

B 1 B 2 

AxB2 

^1^2 


3 

0 

1 

2 


h ^2 

a 


a 

2 

2 

2 

^1^2 

0 

3 




1 

3 


4 





Where : 


<J) = “(a + 3 + p + 6) 

1 2 12 2 

(j) = .(3 + 3 ) 

2 1 2 

4> = -(a + 3 ■•■p 

3 12 11 

These matricies are subsequently reduced and their eigenvalues and eigen- 
vectors are calculated using a series of International Mathematical and Sta- 
tistical Libraries (IMSL) subroutines. A second series of IMSL subroutines is then 
called to solve the linear system AX=Y where the columns of A contain the pre- 
viously calculated eigenvectors, and Y is the input matrix whose columns are the 
individual right hand sides of the equation AX = Y. These solutions are then used 
to calculate probability function coefficients. The probability of being in any 
one state at any time, t, can then be calculated. In general for a Markov-model 
with i states: 


= I Xijexp(-Xjt) 

j=l 

where: = probability of being in state i at time t. 

x-jj = coefficients 

Xj = eigenvalues (assumed here to be distinct) 

Intermediate coverage functions consist of these probabilities or combinations 
of these probabilities. 

Source listings of both SFMODL (Single Fault Markov-Model) and DFMODL (Double- 
Fault Markov-Model) are included in Appendix 1. 
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3.0 Accompi i shments 


3.1 Release One Evaluation 

3.1.1 Evaluation Procedure 

The initial evaluation of CARE III began with a comparison of its results to 

those obtained using the Markov-model program described above. The latter program 

was used to determine, for one special case, the probability of a system failure 

by time t (Q(t) values). This special case involved two stages, the first subject 

-2 

to failures occurring at a rate = 10 fai lures/hour, and the second failure 

-20 

occurring at a rate \ 2 = 10 fai 1 ures/hour. With no critical fault pairs, 
and at time t << 20 hours the only significant contribution to a system failure 
is a coverage failure in stage 1 (Q]q (t))* ^ second, program was designed to 

model transient faults in a similar fashion. The desired result in this case, 
however, was not a failure probability, but instead the probability that a fault 
has been detected as permanent by time t (P[)p (t)), CARE III was run with iden- 
tical inputs so as to derive results valid for comparison. The performance of 
CARE III under extreme conditions was also evaluated by running a series of stress 
tests similar to those listed in Table 1. These stress cases include permanent, 
transient, intermittent and software type fault tests. 

3.1.2 Evaluation Results 

The comparison between the test program results and the CARE III results, at 
that time, were felt to be quite satisfactory, with some improvements to be gained 
by modification of the coverage model integration routines (e.g. doubling criteria). 


8 



The transient fault comparison, however, highlighted two errors in numerical 
computation : 

1. The treatment of a function's steady state value. (For all times 
t greater than the last calculated value, the function was equated 
to zero). 

2. An inconsistency with the function h[)pT (tlx-j) used in the defin- 
ition of Rx.(t) (ref. CARE III PHASE II Report, Mathematical Descrip- 
ti on. Table 1 ) . 

The results of the stress tests indicated some problems with accumulated 
error generated while solving the VOLTERRA type integral. 

3.1.3 Modifications Incorporated Into Second Release 

All of the above mentioned problems were addressed, and either corrected or 
improved for the Phase III second release. A summary of the modifications made to 
CARE III during this period is as follows: 

1. A self modifying capability was added to the doubling difference 
parameter (DBLDF) (ref. CARE III PHASE II Report, User's Manual, Section 
3.1) in COVRGE. In certain instances a DBLDF value may be appropr- 
iate for all but a few of the functions. Under these conditions 

DBLDF will be appropriatly modified, for that function only, and 
that function will be recomputed. If the second attempt is unsuccess- 
ful, a third try will not be attempted. Instead, the program will 
be haulted with diagnostic messages printed. Additionally, array 
sizes were increased to allow for smaller DBLDF values. 

2. The inconsistency in the function Rj^ (t) was determined to be a 

i 

second, i nappropriate, integration of H^pj (tj^^-)» This integration 
was removed thereby correcting the calculation of Rx.(t) in CARE3. 
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3. It was discovered that when the propagated error coverage proba- 
bility C equals 1.0 and no critical fault pairs exist, zero valued 
fault vectors were being unnecessari ly computed. This was corrected in 
the CARES program. 

4. The unnecessary restriction of not allowing the X failure rate to be 
greater than 1.0 in CAREIN was corrected, X may now be greater than 1.0. 

5. The M input parameter was modified in CAREIN and CARES to allow 
zero values, thereby providing a software fault modelling capability. 

3.2 Release Two Evaluation 

3.2.1 Evaluation Procedure 

The procedure used to evaluate release 2 is essentially the same as that used 
in the evaluation of release 1. The Markov-model programs were up-graded to include 
several of the coverage single fault functions; P/^, Pg (benign), Pj^jg (not benign), 

P[_ (latent), and Pgp (detected as permanent), in addition to the double fault func- 
tion pQp. A greater emphasis was placed on the stress test results, both inter- 
mediate and final, so as to characterize any sources of accumulated error and to 
verify any assumptions used. A large part of the effort during this evaluation was 
directed towards the more complicated and error prone coverage program (COVRGE). 

3.2.2 Evaluation Results 

Upon examination of the stress-test results it became apparent that accumu- 
lated error in the integration routines is still a potential problem area. 

Because of the extreme nature of these stress tests the integration 
routines are forced to convolve functions whose maximum time, tmax, differ by 
a much greater ratio than had been tested before. Any small amount of accumu- 
lated error seen with standard cases becomes greatly magnified in these extreme 


10 



cases, to the extent that in one case (3d - see Table 1) an intermediate single 
fault function (P;^) became unbounded. A number of successful measures were 
implemented to help rectify this situation. 

3.2.3 Modi fications Incorporated Into Third Release 

The easiest and most obvious modification, although not without cost, was to 

increase the array sizes, thereby allowing smaller initial step sizes. This modi- 
fication improved the situation only slightly. It became apparent that it would be 

desirable for the step-size doubling procedure to be changed to a halving pro- 
cedure after a function has reached its peak (or valley). As the slope of the 
function decreases, as it peak is approached, the step size goes through a series 
of doublings, and becomes quite large. This step size is then too large to accur- 
ately capture the function as it again begins to rapidly vary. Due to the nature 
of COVRGE the incorporati on of a halving ability was beyond the scope of this 

phase. Instead, the doubling algorithm was modified to restrict doubling for 25 
steps after a function peaks or dips. This approach has worked out as the most 
effective compromise. 

During this evaluation the single fault intermediate function presented 

the greatest problems. Because of the severe extremes of its constituent functions, 
Pg was often the only unacceptable function. In order to make Pg less radical, 
and hence more manageable, its numerical implementation was divided into a series 

of smaller computations, with the more rapidly varying functions separated from the 
slower varying functions. This approach was also successfully implemented in the 
second single fault recursion, Fx (t) (see Table 2A, CARE III PHASE II Report, 
Mathematical Description). 

The effect of these changes was two-fold; the acceptable range of input 

parameters was greatly extended, and an increased accuracy was achieved for 
the 'easier' input cases. In order to detect the few situations where 
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accumulated error could lead to erroneous results, a test has been incor- 
porated into COVRGE to halt the program and produce a diagnostic message. Final 
results will be erroneous if the following situation does not hold: 

t 

/o't> ('fjdx < 1.0 
X 

where [t] = kernal of 

X 

A routine to test whether user inputs are within the value range, specified 
in CARE III Phase II Report, User's Manual, was also incorporated into CAREIN 
during this phase. 
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4. Interpretation of Results 


Some representati ve results of the tests conducted during this phase are 
plotted in Figures 1-7; other results are tabulated in Tables 1-4. (See Appendix 
3 for corresponding CARE III input files.) The figures emphasize comparison of the 
coverage calculations obtained using CARE III to those obtained using the Markov- 
model discussed in Section 2. Three types of plots are used to facilitate this 
comparison; linear, log, and log-log. 

The tables list the various parameters used in each test along with the 
unreliability at user defined flight time (FT) determined by CARE III under each of 
these sets of conditions. Since, in general, it is not possible to get an indepen- 
dent verification of these results, their main value is as a reasonableness test - 
do these results appear to be mutually consistant? 

The tests can be conveniently grouped into three categories; single-fault- 
model tests; double-fault-model tests, and consistency tests. Some observations 
and conclusions about the tests in each of these categories are discussed in the 
following paragraphs. 

4.1 Single-Fault-Model Tests 

The coverage and reliability parameters used in the single-fault-model tests 
are listed in Table 1. Selected intermediate results obtained during these tests 
are plotted in Figures 1 through 5 along with, wherever possible and appropriate, 
the corresponding Markov-model results. 

In general, the CARE III results and the Markov-model results compare 
extremely well. The only discrepancies that appear to be significant are those 
seen on the log plots. These discrepancies show up, however, only when the 
function in question has become insignificantly small. In any case, they 



are caused by the fact that the CARE III model uses a user-specified parameter 
(TRUNC) to determine when to truncate the calculation of an intermediate value 
and set that value to zero. (The Markov-model does not need an analogous 

parameter, since it, in effect, determines an analytic expression for the 
function of interest). The discontinuities evident in the CARE III log plots 

in Figures 1-5 are caused by these truncation events. This is easily seen by 
comparing the plots in Figure 4 with the corresponding plots in Figure 4'. 

TRUNC was changed from its normal 10-4 value in Figure 4 to a value of 10-6 in Figure 
4*. As expected, the location of the discontinuities shifted and their 
magnitude decreased with the decreased TRUNC value. It should be noted, how- 
ever, that the effect of these discontinuities on the primary result of 
interest (the system unrel iabi 1 ity) is entirely negligible. The difference 
between the TRUNC = 10-4 and TRUNC = 10-6 unreliabilities predicted by CARE III 
for the Figure 4/4' test case, in particular, is .002%. The same truncation effect, 
incidently, explains the discontinuities seen in the P* and Q plots in Figures 
1-7; again, these discontinuities are insignificant so far as the results of inter- 
est are concerned. 

As previously noted, the test cases were deliberately selected to stress 
some of the coverage model numerical evaluation procedures. One effect of this 
is particularly evident in the log-log plots (and almost entirely obscured in the 

linear and log plots) of Figure 3 and especially Figure 5. It is seen that several 
of the coverage functions initially exhibit very rapid changes for a short interval 

followed by a period of very slow changes followed, in turn, by another interval 
of relatively rapid changes. Such functions severely stress the numerical integration 
and recursion algorithms that require them as inputs. In order to accommodate the 
initial, rapidly varying part of the function, the integration step size must be 
extremely small. In order to keep the time needed to evaluate the integration 
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from becoming excessive, the step size must be allowed to increase rapidly as the 

rate of change of the function decreases. Unfortunately, any step size selection 
rule compatible with both of these requi rements tends to introduce significant 

error when the function again begins its rapid variation. It was to accommodate 
such functions that some of the modi fications discussed in Section 3,2.2 were intro- 
duced. Their effectiveness can be seen by comparing the log-log plots of the CARE 
III results and those obtained using the Markov-model. 

One area in which CARE III evidently still needs work is the transient model. 

As seen in Figure 2, the P* results (and hence the P* + Q results) tend to oscillate. 
Apparently, this is due to round-off error resulting from the calculation of Rx(t), 
the reliability of an element subject to well-covered transients (so that Rx(t]«l) 
and then using 1 -Rx(t) in subsequent calculations. Such oscillations are clearly 
incorrect and the evaluation procedures should be modified to remove them. This 

should not be difficult to do; unfortunately , time and budget constraints prevented 
this from being accomplished as part of the current effort. 

4.2 Double-Fault-Model Tests 

A Markov-model was also written to provide a means of evaluating independently 
some of the CARE III coverage functions associated with the double-fault model. 

The postulated double-fault model test cases are listed in Table 2. Again because 
of time and budget constraints, only two of these test cases were actually run. 

The results of these runs are shown in Figures 6 and 7. 

In general, the agreement between the Markov-model and the CARE III results 
appear to be satisfactory, although less exact than the agreement between the 
single-fault model results. This is somewhat surprising since the CARE III double- 



-fault model uses techniques similar to those used in the single-fault model, and 
the model itself is considerably simpler. It is believed that modifications to 
the CARE III double-fault model numerical evaluation procedures similar to those 
made in the single-fault case would virtually eliminate these discrepancies. 

Again, however, time and budget constraints precluded this effort. 

It should be remarked that the differences in the two sets of results could be 
at least in part due to inaccuracies in the Markov-model results. The Markov- 
model, for example, was unable to produce any answer in the double (1,2) fault 
case for test 4 B, (cf. Table 2 ). This particular case is especially interesting 
in that CARE III produces a bimodal curve for the intensity of double-fault 
coverage failures, PQp(t) (Figure 7 b). Since the Markov-model did not work in this 
case, and since bimodal coverage function curves are apparently unusual, the ques- 
tion arises as to whether this result is actually valid. An examination of the 
physical situation being modelled, however, suggests that the results are at least 
approximately correct. * 

The only difference between the fi rst-occurring and second-occurring faults 
in this case is that the former has an acti ve-to-benign transition rate of 
1/sec. while the latter has an acti ve-to-beni gn transition rate of 1000/sec. 

Since the first fault must be benign when the second fault occurs (otherwise 
the system would fail immediately), and since the benign-to-acti ve transition 

rate for both faults is slow (1/sec.) relative to the acti ve-to-beni gn transition 
rate of the second fault, the rate of change of p^p is dominated entirely by 
the acti ve-to-beni gn transitions of the second fault. It is easily verified, 
in fact, that the initial value of P[jp(t) is 3+p = 120 /min. This initial 

activity should persist for only about .001 seconds (1.6 x 10 “ 5 min.), since 

that is the expected time for the second fault to become benign. Since no double- 

*An alternate Markov modeling technique at NASA-Langley did reproduce the CARE III 
results. 



fault failure can occur when both faults are benign, the value of P[jp(t) should 

decrease significantly at this point. Since the benign-to-acti ve transition 
of both faults are identical (1/sec.), exactly half of the transitions out of 

the doubly benign state will be to the state in which the first fault is active 
and the second is benign. The occupancy probability of this state should peak 
at roughly 1 second (.016 mins.). Furthermore, since transitions from this 
state back to the doubly benign state occur at the relatively slow 1/sec. 
rate, the rate of change of Pop(t) following this second peak should be much 
slower than that following the first peak. These observations describe precise- 
ly the results predicted by CARE III (remember that the Figure 7 plots are log-log 
plots), thus verifying, at least qualitatively, that the CARE III double-fault 
coverage model is performing correctly in this otherwise unverified case. 

4.3 Consistency Tests 

Consistency tests run during this phase were of two types: 1) The test cases 

developed during this phase and used primarily to test the single-and double- 
fault coverage models were also allowed to run to completion, thereby producing 

reliability estimations that could be compared from test to test and evaluated 
for consistency. 2) Some of the test cases run during Phase I of the CARE III 

program were re-run, again to verify consistency of results and to determine 
whether any of the changes made during this phase of the program significantly 

altered any of the earlier results. 

4.3.1 Test Cases Developed During This Phase 

Several observations can be made concerning the consistency of the results 
presented in Table 1: 

1) The failure probablity decreases when the error propagation 
rate increases if C = 1 and all other parameters remain the same 
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(compare test cases la and Ih, Ic and li, Id and Ig). This initially 
counter-intuitive result is clearly correct when it is observed 
that, when C = 1, all propagated errors are detected; thus, 
the quicker they propagate, the shorter the latency of the fault. 

2) The previous statement also holds for long-term transients 
(compare test cases 2c and 2c') but the reverse holds for short-term 
transients (test cases 2a and 2a'). This can be explained by the fact 
that, while transients behave much like permanent faults if the 
active period of the fault is long compared to the other coverage 
parameters, the quick propagation of errors resulting from short- 
term transients increases the likelihood that they are detected as 
permanent (Pa=1j %=0). Since the latency period for short-term 
transients is, by definition, short in any event, this latter 

effect dominates. 

3) When the probability that any unit survives for the interval of 
interest is kept constant, the effect of a nonconstant hazard rate 
is to increase the failure probability regardless of whether the 
hazard rate is an increasing or a decreasing function of time 
(compare the numerical results of test case Ih with cases le and If). 

This is clearly true, since a non-uniform hazard rate concentrates the 
failures at the beginning (when the hazard rate is decreasing function of 
time) or at the end (when it increases with time) of the interval in 
question. In either case, the likelihood of double faults is increased. 

4) A less-than-perfect probability of detecting propagated errors can 
have a profound effect on the probability of system failure 
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(compare test cases lb and lb' with all the others). These results 
can even be roughly verified quantitatively. When C=1 , coverage 
failures occur only when one fault occurs within the latency period 
of an earlier fault. Since the latency of a fault is of the order 
of the faster of the fault detection and error propagation delays 

(reciprocal rates), it is typically of the order of 0.1 to 1 second, 
or about 0,01% of the total interval of concern here. Thus, the probability 

of failure due to a double fault is roughly 10"^q2 with q the probability 

of a single fault. The probablity of a failure due to an uncovered 
single fault is roughly (l-C)q. Since q is approximately 10“^ here, 

this argument would predict a double-fault failure probability of 
roughly 10“^^ and a single-fault failure probablity of 10"^ when 
C=.99 and 10-8 when C=.999, thus supporting the observed results. 

5) A constant fault-detection rate is somewhat less effective 
than a constant fault-detection density function (compare test cases 
Ih and Ih'). When faults are detected at a constant rate 6/sec., 
the probability that a fault has not been detected after being 
active for t seconds is e-St, When the fault detection density 
function is a constant 6/sec., this same probability takes the 
form l-6t (0<t<l/6). Since e-5t>(l-6t) for all 0<6t<l, this 
result is obviously correct. 

A constant-rate fault-detection function results, for 
example, when a diagnostic program is randomly scheduled; a 
constant-density function results when it is run on a fixed 

schedule. Equating the two 6-parameters is meaningful, since doing 
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so is equivalent to specifying that the same amount of time 

is devoted to the diagnostic program in the two cases. Never- 
theless, the expected fault-latency period, when diagnostic pro- 
grams are randomly scheduled at a rate 6/sec. is twice that when 
programs are run on a fixed schedule every 6 seconds. To 
equate the latency periods in the two cases, it is necessary to 
increase the randomly scheduled diagnostic program rate to 26/sec. 

Doing so decreases the failure probability to that shown in test 

Ih". In this case, then, the random scheduling strategy is better. 

This result is less obvious since e-26t is neither always greater 
than nor always less than l-6t over the interval 0<t<6t. The fact that 
e-25t initially decreases twice as rapidly as l-6t, and that the 
probability of a latent fault is therefore decreased correspondingly 
more rapidly at least adds credibility to the CARE III result. 

6) The failure probability decreases as the detection rate increases, 
but the importance of the detection rate is diminished when the error 

propagation rate is high and the probability of detecting propagated 
errors is unity (compare, for example, cases la and Ic). These results 
are clearly as one would expect. 

7) The shorter the transient, the less likely it is to cause a 

system failure (compare test cases 2a, 2b and 2c, and cases 2a‘, 2b' 
and 2c'). This should be expected for two reasons: a detected 

transient fault is less likely to be diagnosed as permanent if it 

is detected after it reaches the benign state (in fact, PB=0 here); 
and, the shorter the time spent in the active state, the 



less likely will the effect of the fault be present at the time 
of a subsequent fault. 

8) The effect of an intermittant fault depends both on the frac- 
tion of time it spends in the active state (contrast test cases 3a and 3b 
with test case 3d, for example) and on the rates at which it makes transi- 
tions between these states. At least when propagated errors are 
certain to be detected, it is significantly worse for a fault to be 
almost always benign than for it to be almost always active (compare, 
for example, test cases 3c" and 3d"). The result is due to the fact that 
the more time a fault spends in the active state, the more quickly 
it will be detected and hence the less likely it will contribute to 
a system failure (since C=l). This is apparently (but not obviously) 
more significant than the fact that a fault is harmless when it is 
in the benign state. That this last statement is true is suggested 
by the following agrument. Suppose that two intermittant faults 
simultaneously exist for M units of time and that each is active 
during a given unit of time with probability 1/N, independent both of 

the other fault and of its own past. Then the probability that the 

, 2N 

two are never simultaneously active is (1-1/N) which, for large M, 

is roughly e“^ « .14. If the two simultaneously exist for only half 

as long (N/2 time units) this probability increases, but it is still 
-1 

only e » .37. Thus, even though both faults are almost always benign, 
the fact that they exist for an extended interval make the probability 
quite large that they are, at some instant, both active (and hence 
cause the system to fail). Thus, again, the observed results appear 
to be at least qualitatively consistent. 
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9) Additional consistency checks can be made by comparing the 
results for different types of faults when the parameters are 
such that their differences should be relatively insignifi- 
cant. As already observed, for example, when intermittants 
spend most of the time in the active state they tend to look 
like permanent faults. This is confirmed by comparing the 
results of case 3c with those of case li. 

4.3.2 Test Cases Developed During Phase I (FTMP) 

Consistency during the evaluation of CARE III can be seen by examining the 
results of Table 3. This table tabulates the results of the Fault Tolerant Multi- 
processor (FTMP) test cases for a number of CARE III versions. Included are some 
of the results reported on in the CARE III Final Report, Phase I, Volume I 
(Table 3.3), the Phase II (release 1) results, and .the current Phase III (release 
3) results. 

As can be seen, there is a consistent trend in the results predicted by 

CARE III for each of the versions tabulated, the severity of which is pro- 
portional to the ratio a/3. This is evidently a consequence of the different 
restrictions placed on these models. In order to reduce the complexity of the 
Draper model, any three simultaneous latent faults were equated to a system fail- 
ure. The Phase I model identifies three simultaneous latent faults with a system 
failure only if at least two of these faults constitute a critical pair. The 
Phase II model eliminates all restrictions on the number of simultaneous latent 

faults; a system failure occurs only when both faults in a critical pair are 
simultaneously active. This aspect of the model was not changed in Phase III. The 

differences between the release 1 and release 3 results can be accounted for by 
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the changes made to the way in which coverage results are used in the relia- 
bility evaluations. In general, these changes resulted in tighter upper 
bounds on unreliability by eliminating double counting (e.g. by eliminating 
the possibility that the same fault leads to two system failures by being 
involved, possibly at different times, in two critical pairs). As would be 
expected, the effects of these different restrictions become more apparent 
as the ratio a/e increases since the amount of time a fault remains latent is 
an increasing function of this ratio. 

4.3.3 Test Cases Developed During Phase I (SIFT) 

Similar comparisons were made between the reliability predictions for the 
Software Implemented Fault Tolerance (SIFT) computer, both those derived by SRI 
and those produced by the Phase I version of CARE III, with those generated by 
the current CARE III (Table 4). 

In Phase I the coverage model had not yet been programmed, so the coverage 
inputs to the reliability program were those correspondi ng to the SRI model in 
which every fault has a latency of exactly t seconds. The CARE III coverage 
model does not allow constant-time latency periods (although this capability 
could be included if it were of general interest). Consequently, CARE III was 
exercised, for these examples, using a constant-density fault detection function 
with a T seconds mean-time to detection. This is obviously only a rough 
approximation to a constant t second detection delay. Even so, the results 
thus obtained compare very well with those derived both by CARE III using 
the simulated coverage model inputs and by SRI, thereby giving added credence 
to the current version of CARE III. 
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5,0 Conclusions and Recommendations for Further Study 


In general, the CARE III results are in excellent agreement with those 
derived independently, at least in those restricted cases in which independent 
evaluation is readily obtained. There remain some flaws in CARE III, however, 
which could not be eliminated under the current budget and schedule constraints. 

Specifically, the transient model produces results that show instabilities 
at least under certain conditions, and the double-fault model is less accurate 
than it should be. 

The following recommendations for further study are suggested by the re- 
sults obtained during this effort: 

1. Obviously, the flaws uncovered in the transient and double-fault 
cases should be analyzed and eliminated, 

2. Since it is believed that many of the problems encountered during 
those tests, including those in the double-fault model, have to do 
with the fact that the integration routine step size can be changed 

adaptively only by doubling it, this restriction should be removed. 

This restriction was initially felt to be acceptable since it was 
believed that coverage functions tended to have monotonical ly 
decreasing derivatives. This is evidently not the case. 

3. Under certain conditions, the coverage model evaluation was found 
to take an excessive amount of computer time. This problem could 
be eliminated by the integration routine modification recommended 
above. In addition, however, it is recommended that an alter- 
native, Markov-type coverage model, similar to that described 

in Section 2.2, be incorporated into CARE III to be used whenever 
the user specifies only constant rate coverage parameters. 

Although this case is, somewhat restrictive, it is expected to 
be the one most commonly used. Even when it is not precisely 
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applicable, it could be used to obtain preliminary results and to 
screen out those conditions meriting more careful and more pre- 
cise scrutiny. When the Markov-model can be used, the run time 
in many cases could be drastically reduced. 

4. Although the testing accomplished here has significantly in- 
creased our confidence in CARE III, it can by no means be 
asserted that CARE III has been completely verified. Further 
testing is highly recommended. 
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(Function P* SUM vs. Time-Mins., CARE III Model) 
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DOUBLE-FRULT TYPE PAIR ( 1, 1) FUNCTION 
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(Function Q + p* SUM vs. Time-Mi ns., CARE III Model) 
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DOUBLE-FAULT TYPE PAIR ( 1, 2) FUNCTION 
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DOUBLE-fRULT TYPE PRIR ( 2, 2) FUNCTION 
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PERMANENT FAULT TEST CASES 


Table 1 


TEST 


CASE 

a 

0 

6 

P 

e 

Pb 

Pa 

c 

tmax 

X 

u 

RESULTS 

1 a 

0 

0 

3.6E3 

3.6E4 

3.6E5 

0 

1 

1 

60 min. 

10-5 

1 

2.0572878738E-14 + 


0 

0 

3.6E3 

3.6E4 

3.6E5 

0 

1 

.99 

i» 

10-5 

1 

3.5777939190E-07 

lb 

0 

0 

3.6E3 

3.6E4 

3.6E5 

0 

1 

.999 

II 

10-^ 

1 

3.5777957557E-08 

Ic 

0 

0 

0 

3.6E4 

3.6E5 

0 

1 

1 

II 

10“5 

1 

2.2233692679E-14 

Id 

0 

0 

3.6E5 

3.6E4 

3.6E5 

0 

1 

1 

II 

10-5 

1 

4.8809076939E-15 

le 

0 

0 

0 

3.6E4 

3.6E4 

0 

1 

1 

11 

10-10 

0.5 

2.3100883426E-13 

If 

0 

0 

0 

3.6E3 

3.6E4 

0 

1 

1 

II 

3.162 

E-3 

2 

2.4820526862E-13 

ig 

0 

0 

3.6E5 

3.6E3 

3.6E4 

0 

1 

1 

11 

10-5 

1 

4.9061433149E-15 

Ih, 

0 

0 

3.6E3 

3.6E3 

3.6E4 

0 

1 

1 

II 

10-5 

1 

7.1097745431E-14 

Ih 

0 

0 

7.2E3 

3.6E3 

3.6E4 

0 

1 

1 

II 

10-5 

1 

6.4784031556E-14 

li 

0 

0 

0 

3.6E3 

3.6E4 

0 

1 

1 

11 

10-5 

1 

1.8629094420E-13 


NOTE: p and e use constant rate functions; 6 uses constant density for all but 
cases with *'s. 


+ Test cases with corresponding plots 



TRANSIENT FAULT TEST CASES 


Table 1 cont. 


TEST 

CASE 

a 

3 

6 

P 

e 

Pa 

2a 

3.6E4 

0 

0 

3.6E4 

3.6E5 

1 

2a' 

3.6E4 

0 

0 

3.6E3 

3.6E4 

1 

2b 

3.6E3 

0 

0 

3.6E4 

3.6E5 

1 

2b’ 

3.6E3 

0 

0 

3.6E3 

3.6E5 

1 

2c 

3.6E2 

0 

0 

3.6E4 

3.6E5 

1 

2c' 

3.6E2 

0 

0 

3.6E3 

3.6E4 

1 


Pb 

c 

tmax 

X 

RESULTS 

0 

1 

60 

10-5 1 

9.4311701023E-17 

0 

1 

60 

10-5 1 

2.1241235519E-19 

0 

1 

60 

10-5 1 

7.3331992621E-16 

0 

1 

60 

10-5 1 

1 .9607740169E-16 

0 

1 

60 

10-5 1 

9.7825070511E-16 + 

0 

1 

60 

10-5 1 

1 .5202140048E-15 



INTERMITTANT FAULT TEST CASES 


Table 1 cont. 


TEST tmax 


CASE 

a 

3 

5 

P 

e 

Pa 

Pb 

c 

(min) 

X 

U) 

RESULTS 

3a 

3.6E3 

3.6E3 

0 

3.6E3 

3.6E4 

1 

0 

1 

60 

10-5 

1 

3.9885881 529E-1 3 

3a' 

3.6E3 

3.6E3 

3.6E4 

3.6E3 

3.6E4 

1 

0 

1 

60 

10-5 

1 

4.9337584406E-14 

* 3a" 

3.6E3 

3.6E3 

3.6E4 

3.6E3 

3.6E4 

1 

0 

1 

60 

10-5 

1 

5.2490555488E-14 

3b 

3.6E6 

3.6E6 

0 

3.6E3 

3.6E4 

1 

0 

1 

60 

10-5 

1 

4.6277452759E-13 

3b' 

3.6E6 

3.6E6 

3.6E4 

3.6E3 

3.6E4 

1 

0 

1 

60 

10-5 

1 

3.5945484343E-14 + 

* 3b" 

3.6E6 

3.6E6 

3.6E4 

3.6E3 

3.6E4 

1 

0 

1 

60 

10-5 

1 

3.6243046680E-14 

3c 

3.6E3 

3.6E6 

0 

3.6E3 

3.6E4 

1 

0 

1 

60 

10-5 

1 

1 .8671106774E-13 + 

3c' 

3.6E3 

3.6E6 

3.6E4 

3.6E3 

3.6E4 

1 

0 

1 

60 

10-5 

1 

1.2962063686E-14 

* 3c" 

3.6E3 

3.6E6 

3.6E4 

3.6E3 

3.6E4 

1 

0 

1 

60 

10-5 

1 

2.0598920303E-14 

3d 

3.6E6 

3.6E3 

0 

3.6E3 

3.6E4 

1 

0 

1 

60 

10-5 

1 


3d' 

3.6E6 

3.6E3 

3.6E4 

3.6E3 

3.6E4 

1 

0 

1 

60 

10-3 

1 

2.6004620396E-12 + 

* 3d" 

3.6E6 

3.6E3 

3.6E4 

3.6E3 

3.6E4 

1 

0 

1 

60 

10-5 

1 

2.6467251658E-12 

NOTE: 

Case 3d 

did not run 

to completion. 

due 

to 

an unacceptable 

amount of 


accumulated error. 
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DOUBLE FAULT TEST CASES 


Table 2 


TEST 



CASE 

a 

3 

6 

P 

e 

* 

4A 

3.6E3 

3.6E3 

3.6E3 

3.6E4 

3.6E5 



3.6E3 

3.6E3 

3.6E3 

3.6E4 

3.6E5 

* 

4B 

3.6E3 

3.6E3 

0 

3.6E3 

3.6E4 



3.6E6 

3.6E3 

0 

3.6E3 

3.6E4 

★ 

4C 

3.6E3 

3.6E3 

0 

3.6E3 

3.6E4 



3.6E3 

3.6E6 

0 

3.6E3 

3.6E4 

* 

4D 

3.6E3 

3.6E3 

0 

3.6E3 

3.6E4 



3.6E6 

3.6E6 

0 

3.6E3 

3.6E4 

* 

4E 

3.6E3 

0 

0 

3.6E3 

3.6E4 



3.6E3 

0 

0 

3.6E3 

3.6E4 

* 

4F 

3.6E3 

0 

0 

3.6E3 

3.6E4 



3.6E3 

3.6E3 

0 

3.6E3 

3.6E4 


Pa 

Pb 

c 

tmax 
(min ) 

X 

u 

FAULT 

TYPE 

1.0 

0.0 

1.0 

60 

10-5 

1 

1 + 

0.9 

0.1 

1.0 

60 

10-5 

1 

2 

1.0 

0.0 

1.0 

60 

10-5 

1 

1 + 

1.0 

0.0 

1.0 

60 

10-5 

1 

2 

1.0 

0.0 

1.0 

60 

10-5 

1 

1 

1.0 

0.0 

1 .0 

60 

10-5 

1 

2 

1 .0 

0.0 

1.0 

60 

10-5 

1 

1 

1.0 

0.0 

1.0 

60 

10-5 

1 

2 

1.0 

0.0 

1.0 

60 

10-5 

1 

1 

1.0 

0.0 

1 .0 

60 

10-5 

1 

2 

1.0 

0.0 

1.0 

60 

10-5 

1 

1 

1.0 

0.0 

1.0 

60 

10-5 

1 

2 
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FTMP CASES 


Table 3 




CARE III 

CARE III 

CARE III 

a 

3 

PHASE III 

PHASE II 

PHASE I 

10 

1 

1.1149 


1.1161 

10 

10 

1.2196 


1.2041 

10 

100 

1.1725 

1 .1682 

1.1718 

10 

1000 

1.123 


1.1274 

100 

1 

0.9331 


1.0054 

100 

10 

1.9527 


1.9072 

100 

100 

1.664 


1.6585 

100 

1000 

1.215 

1.2142 

1.2181 

1000 

1 

0.263 

0.2847 

0.4239 

1000 

10 

3.387 

3.3973 

3.7975 

1000 

100 

6.3614 


6.1513 

1000 

1000 

2.156 


2.1198 


Failure Probability (x 10-8) 


DRAPER 

MODEL 


1.124 
1.207 
1.174 
1 .129 

1.2073 
1 .924 
1.661 
1.220 

1.46 

4.22 

6.17 

2.12 


NOTE: Not all cases were run for Phase II 


SIFT CASES 


Table 4 


X 

X 

6 

CARE III 
PHASE III 

CARE III 
PHASE I 

SRI 

1 

2 






l.OE-4 

l.OE-5 

180 

2.4858873E-8 

2.4861 769E-8 

2.50 

E-8 

1.0E-4 

l.OE-5 

180 

1 .9880060E-8 

1 .9882421 E-8 

2.00 

E-8 

l.OE-4 

l.OE-5 

180 

4.5428416E-8 

4.5400324E-8 

4.56 

E-8 

l.OlE-4 

l.lE-5 

18000 

2.5373536E-10 

2.5115101E-10 

2.55 

E-10 

l.OlE-4 

l.lE-5 

18000 

2.081 76805E-10 

2.0611656E-10 

2.10 

E-10 

1 .OlE-4 

l.lE-5 

18000 

3.6450809E-8 

3.6412602E-8 

3.65 

E-8 
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APPENDIX 1 


Source Listings 
SFMODL 
DFMODL 




PROGRAM SFMODLCINPU T, OUTPUT, TAPE5=INPU7,TAPP6=0UTPUT,PLFILE, 
1 TAPEA=FLF ILE) 

C THIS PROGRAM CALCULATES INTERMEDIATE FUNCTIONS USED IN THE 
C THE SINGLE FAULT MODEL IN COVRGE. 




COMMON// SFAR(1P00),IDUBAR(40),EIGA(A,A),TIME(1R00), 

1 ITITLE(6),JT1TLF.(6),PAR(1800,A) 

COMMON/ FLTPM/ ALPHA,BETA,DELTA,RHO,FPSILON,PA,PU,C 
DIMENSION THASR(A) 

LOGICAL PF F LA G,G ENXPTS, ANOTHER, PD PF LG, PLTFLG,QF LAG 
COMMON/FIGCOM/ E1GSD(A,A,A),EIGG*R(A) 

DATA ANOTHER/. FALSE. /,TBASR/5HHRS ,5HMINS ,5HSECS ,5HMSECS/ 
REWIND 4 

PLIFLG = .FALSE. 

WRITE (6,9) 

9 FORMAT C5X,"TYPF 8 REAL NUMBERS SEPARATED GY COMMAS FOR ", 

1 /■' ALPHA ,bE TA ,DELTA ,RHO, EPS I LON,PA,PB,C’*) 

READ(5,^) A LPHA,HFIA, DELTA, RHO, EPSILON, PA, PB,C 
WRITE(6,59) 

59 F0RMAT(/,3X,"TYPE AN INTEGER .LE.4 FOR II ML BASE AS IN CARE3") 
RFADC5,*) ITBASF 

30 WRJTE(6,31) 

QFLAG = .FALSE. 

31 FORMAT (/,3X, "ENTER FUNCTION TO BE CALCULATED AS: * P A ‘ ' PB ‘ • PNB 

1 ", » PL* , ' PF » , *PDP ' ,OR *0'") 

RFAD(5,32) FUNCTYP 

32 F0RMAT(A3) 

IF(FUf<CTYP.Nt-3hQ ) GO TO 3 3 
WRITE (6,34) 

34 FORT. AT (/,3X, "ENTER FLIGHT TIME, NUMBER OF 'Q* S T L P S ( . L FJ . 6 4 ) " ) 
RFAD(5,*) FT,‘JGSTPS 


QFLAG = .TRUE. 

PFFLAG = .FALSE. 

FDPFLG = -FALSE. 

GO TO 35 
33 WRITE(6,40) 

40 FORMAT (/ ,3X, "ENTER INITIAL STEP SIZE") 

READ(5,*) STEP 
STEPIN = STEP 
WRITE! 6,50) 

50 FORMAT!/, 3X, "ENTER DOUBLING ARRAY; DELIMIT WITH COMMAS.",/) 

READ(5,*) ( IDUBAR ( N) , M=l,40 ) 

ITSTPS = 0 
DO 51 N = 1,A0 

51 JTSTPS = IDUBAR(N) + JTSTPS 
ITSTPS - ITSTPS + 1 

ICOEF = 0 
PFFLAG = -FALSE. 

PDPFLG = -FAL SE- 
RF = 0.0 

GENXPTS - -FALSE. 


• I 
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c 

c 

c 


c 

c 

c 

c 

c 


I 


55 

56 


IF (F UNCTYP-EQ.3HPA ) IFUNCTN 
I F (FUNCT YP .EQ .3HPP ) IFUNCTN 
IF (FUNCTYP .EQ .3HPNB) IFUNCTN 
IF(FUNCTYP-E0.3HPL ) IFUNCTN 
IF( FUNCTYP.EQ.3HPF ) PFFLA6 
IF (FUNCTYP.EQ.3HPDP) PDPFL6 


1 

2 

3 

TRUE . 
TRUE . 


INDEX=1 

IF (IFUNCTN. NF.O -OR. FFFLAG -OR- PDPFLG) 
WRITE (6,55) 

FORMAT (/,3X, "UNRECOGNIZED FUNCTION") 

60 TO 30 
NSTPST=1 
NSTFF= IDUEAR( 1 ) 


T = 0 .0 

IF (ANOTHER) GO TO 25 


GO TO 56 


CHOOSE TIME BASE CONVERSION FACTOR 


35 TBCF=0.0 

TBASE=TBASR(ITBASE) 

IF (TBASE. EG.5HHRS ) TBCF=1.0 
IF (TBA SE -EO.SH^JNS ) TBCF=60.0 
I F (TBASE .EG.5HSFCS ) TBCF=3600.0 
1F(TBASE.EQ.5HMSECS) TBCF=3.6E6 
IF (TBCF .NE .0.0) 60 TO 17 
WRITE(6,23) TBASE 

23 FORMATE/"** ERROR INCORRECT TIME BASE - ",AD 
STOP 

17 ALPHA=ALPHA/TBC F 
BE TA=BETA/ TBC F 
DELTA = DELTA /TDC F 
EPSILON=EPSILON/TBCF 
RHO=RHO/TBCF 


EIGA(I,J) ARE THE ELEMENTS OF THE MATRIX WHICH REPRESFNFS 
THE CAREIII SINGLE FAULT MODEL 


18 EIGA(1,1) 

- 

- (ALPHA + RHO+PA*DELTA) 

EIGA (1,2) 


BETA 

E I G A ( 1 , 3 > 


(1-PA)*C*EPSIL0N 

EIGA (1,^) 

- 

0 . 0 

EIGA(2,1) 

= 

ALPHA 

EI6A(2,2) 

r 

-BETA 

EIGA (2,3) 

r 

o 

1 

o 

EIGA (2,A ) 

= 

(1.0-Pe)*C*EPSILON 

EIGA (3,1 ) 

- 

RhO 

EIGA (3,2) 

= 

0.0 

EIGA( 3,3) 

r 

- (ALPHA + EPSILON) 

E1GA(3,4) 

= 

BETA 

EI6A(A,1 ) 


0 . 0 

EIGA (4,2) 

= 

0.0 

EIGA (4,3) 

r 

ALPHA 

EIGA (4,4) 

= 

-(BETA+EPSILON) 


CALL EIGEN(ETGA) 

DO 20 1=1,^ 

EIGWR(I) = - EIGWRU) 
20 CONTINUE 
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25 IF(QFLAG) CALL S FQ ( S F A R , T 1 E , F T , NQS T PS ) 

IF (.NOT.PDPFLG) GO TO 22 

CALL POP (SFAR, TIME, STEF, ITSTFS, ID UBAR) 

GO TO 75 

22 IFC.N’OT. PFFLA6) GO TO 60 
DO 58 I=NSTPST,NSTPF 
DC 57 L=l,4 

IF(EI6WR(L) .EQ.0.0) GO TO 57 

26 PF = (((EIGSD(3,L,1)+EI6SD(4,L,1))/EIGWR(L)) 

1 *(1 , 0-PREEXP(-EIGWR( L) *T) ) ) +P F 

57 CONTINUE 

TIME(I) =r T 
T=T + STEP 

PF = (1.0-C)*FPSILON*PF 
SFAR(I) = PF 
PF = 0.0 

58 CONTINUE 
GO TO 71 

60 IFCOFLAG) GO TO 74 

DO 70 1 = NSTPST,NSTPF 
DO 65 ICOEF = 1,4 

TRM1=EI6SD(IC0EF,1,1)*PREEXP(-(EIGWR(1)*1)) 
TRM2=EIGSD(ICCEF,2,1)*PREEXP(-(E1GWR(2)*T)> 
TRM3=EIGSD(ICCEF,3,1)*PRFEXP(-(FIGWR(3)*T)) 
TRM4=EI6SD(IC0EF,4,1)*PRFEXP(-(EIGWR(4)*T)) 
PAR(I,IC0EF)=TRM1+TRM2+TRM3+TRM4 
I F (PAR (I ,I COEF ) .LT . 0 . 0) PARCI, ICOEF) = 0-0 
65 CONTINUE 

T1ME(I)=T 

T-T+STEP 

70 CONTINUE 

71 CONTINUE 
INDF.X = INDEX + 1 
NSTPST=NSTPF+ 1 

NSTPF=NSTPST-1+IDUBAR(INDEX) 

STEP=STEP*2. 

I F ( I . LF. ITSTPS) GO TO 25 
IF(PFFLAG) go to 74 
DO 73 I = 1, ITSTPS 

PARCI, 3) = PARCI, 1) + PARCI, 3) + PARCI, 4) 

PARCI, 4) = PARCI, 2) + PARCI, 3) 

SFARCI) = PAR ( I ,IFUNCTN ) 

73 CONTINUF 

74 CONTINUE 

75 WR1TE(6,76) 

76 FORMAT C/,3X,"W0ULD YOU LIKE THIS ARRAY PRINTED AT THE TERMINAL ?'•) 
READ(5,101) lANSWER 

IF Cl ANSWER .NF -IHY) GO TO 91 
DO 90 1=1, ITSTPS 

WR1TE(6,80) I,SFAR CI),T1ME (I) 

80 FORMATC/,3X,I4,5X,E16.10,5X,1PE16.10> 

90 CONTINUE 

91 CONTINUE 
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WRITE (6,95) 

95 FORP^AT (/,3X, "WOULD YOU LIKE THIS FUNCTION PLOTTED ?") 

READ(5,101) lANSWER 

IFCIANSWER-EQ-IHY) PLTFLG - .TRUE. 

IF( lANSWER-NE.lHY) GO TO 102 
WRITE(G,96) 

96 FORMA T (/ ,3X, "ENTER PLOT TYPE! l^LINEAR, 2=L06, 3=B0TH") 

READ(5,*) LNORLG 

ENCODE (55,97, TTITLE ) FUNCTYP 

97 FORMAT (9HFUNCTION ,A5,1H1) 

ENCODE(60,9fi,JTITLF) STEPIN,TBASE,ITSTPS 

98 F0Rrv'AT(26HX AXIS WITH INITIAL XSTFP= ,1PE8.2,A5, 

1 13H PTS FLCTTECr, IA,1 H$) 

CALL CPL0T(SFAR,TIME,STEPIN,GENXPTS,ITSTPS,LN0RLG,ITITLE,JT1TLF) 
102 WRITE (6,100) 

100 FORMAT (/,3X, "DO YOU WISH TO COMPUTE ANOTHER FUNCTION?") 
READ(5,101) lANSWER 

101 FORMATCAl) 

ANOTHER = .TRUE. 

I F (I ANSWER . EQ. 1 HY) GO TO 30 
IF (PLTFLG ) CALL DONEPL 
STOP 
END 

FUNCTION PREEXP(X) 

C 

DATA REALMAX/l.OE + 322/, REALM IN/ 1 . Ot -2 93/ ,E XPMAX /7A 1.67/, 

2 EXPMIN/-675.82/ 

C 

IF (X.GT.EXPMIN .AND. X.LT.EXPMAX) GO TO 100 
C SET FUNCTION TO A VALUE VERY CLOSE TO 0.0 PUT NOT EQUAL TO 0.0 
IF (X.LE .EXPMIN) PREEXP = REALMIN 
C SET FUNCTION TO THE MAXIMUM VALUE THE CDC CAN HANDLE 
IF (X .6E . EXPMAX ) PRFEXP = REALMAX 
GO TO 200 

100 PREEXP = EXP(X) 

200 RETURN 
END 
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SUBROUTINE PDP(POPAR,TIME^STEP,ITSTPS,IDUBAR) 

COMMON/FLTPM/ ALPHA,BETA,DELTA^RHO,EPSlLON,FA,PD,C 
DIMENSION PDPAR(1),TIME(1)^1DUBAR(1) 

INDEX = 1 
NSTPST = 1 

NSTPF = IDUBARC INDEX) 

T = 0-0 

CNl = (2.0*ALPHA+RH0+EFSILON+PA*DELTA) /2-0 
CN2 = SORT ( CRHO-EPSlLON + PA*DELTA) **2 .0 
1 +^.0*RHO^Cl-PA)*C*EPSILON)/2.0 

RLAMl = CNl + CN2 
RLAM2 = CNl - CN2 
RLAM3=EPSIL0N 
IF (PA-EQ.l-O) GO TO 20 

A 1= (RLAM2- (ALPHA + RHO + PA * DELTA) )/(RLAM2-RLAMl) 
A2=(RLAM1-(ALPHA+RH0+PA*DELTA))/(RLAM1-RLA^2) 

Pl=( (ALPHA+RHO+PA*DELTA-RLAMl)/ ((1.0-PA)*C*EPSIL0N))*A1 
B2=((ALPHA+RHO+PA*DELTA-RLAM2)/((1.0-PA)*C*EPSILON))*A2 
60 TO AO 

20 IF ((RHO-FPSILON+DELTA) .LT.0.0) 60 TO 30 
A1 = I .0 
A2 = 0.0 

Bl = -RHO/ (RHO-EPSILON + DELTA ) 

B2 = -Bl 
60 TO AO 
30 A1 = 0.0 
A2 = 1.0 

Bl = RHO/ ( RHO-EPSI LON+D ELT A) 

B2 = -Bl 

AO Cl= (ALPHA/ (EPS! LON-RLA Ml ))*B1 
C2=(ALPHA/(EPSIL0N-RLAM2))*B2 

C0NST1-PA*DELTA*A1+PA*C*EPS1L0N*B1+PB*C*EPSIL0N*C1 

C0NST2=PA*DELTA*A2+PA*C*EPSIL0N*B2+PB*C*EPSIL0N*C2 

C0NST3-PB*C*EPSIL0N*(C1+C2) 

C 

C MAIN CALCULATIONS 
C 

50 DO 100 I=NSTPST, NSTPF 

PDPAR(I)=CONST1*((1.0-PREEXP(-RLAM1*T))/RLAM1) + CONST2*((1.0- 

1 PREEXP(-RLAM2*T) ) /RLAM2) - C ONS T 3 * ( ( 1 . 0 -P R E E XP (-R LA M3 * T ) ) / 

2 RLAM3) 

TIME (I )=T 
T=T+STEP 

100 CONTINUE 

INDEX = INDEX + 1 
NSTPST = NSTPF+ 1 

NSTPF = NSTPST + I DUB AR C I NDEX ) - 1 

STEP =: STEP * 2 

IF ( I. LF. ITSTPS) 60 TC 50 

RETURN 

END 
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SUPROUTINE SFQ(QAR,TIKE,FT,NSTEPS) 

COMMON /FLTPM/ A LPH A ,BE T A ,D E L T A , RHO, E PS I LON, P A , PB , C 
COMMON/EI6COM /EI6SD ,FIGWR (A) 

DIMENSION QAR (1) ,TIME (1) ,PF AR (65) ,PFLAR (65) 

DATA RLAMBDl/l.OE-02/ 

THIS SUBROUTINE GENERATES FINAL »Q' VALUES. 

STEP = FT/NSTEPS 
ITSTPS = NSTEPS + 1 
C 

C SET INITIAL KNOWN CONDITIONS 
C 

PFAR(l)-0.0 
PFLARd )=0.0 
QAR (1 )=0 . 0 
T=STEP 
T I M E ( 1 ) = 0 . 0 
C 

C CALCULATE COEFFICIENTS AND CONSTANTS 
C 

CONST=(1.0-C)*EPSILON 

CD1= EIGSD(3,1,1)+E1GSD(A,1,1) 

CD2= EIGSD(3,2,1)+EI6SD(4,2,1) 

CD3= EI6SD(3,3,1)+EIGSD(A,3,1) 

CD^= EIGSO (3,4,1)+EIGSD(A,A,1) 

Z1 = EIGWR (l)-RLAMBDl 
Z2 = EIGWR ( 2) -RLAMBDI 
Z3 = EIGWR(3)-RLAMBD1 
Z4 = E IGWR (4) -RLAMBDI 
C 

C MAIN CALCULATIONS 
C 

DO 150 ITAU=2, ITSTPS 
XI = -(EIGWR(1)*T) 

EIGLIT = 1.0 - PREEXP(Xl) 

X2 = -(EIGWP(2)*T) 

EI6L2T = 1.0 - PREEXP(X2) 

X3 = - (EIGWR( 3) *T) 

EIGL3T = 1.0 - PREEXP(X3) 

X4 = - (EIGWR (4)*T) 

EIGL4T - 1.0 - PRFEXP(XA) 

X5 = -(Z1*T) 

EIGL5T = 1.0 - PREEXP(X5) 

X6 - “(Z2*T) 

E1GL6T = 1.0 - PREEXF(X6) 

X7 = -(Z3*T) 

EIGL7T - 1.0 - PREEXP(X7) 

X8 = -<Z4*T) 

EIGL8T = 1.0 - PREfXP(X8) 

PFAR( ITAU) =CONST* ((( CDl* EI6L IT ) /EIGWR (1 ) ) + ( ( C D2* E I G L2 T ) / 

1 EIGWR(2))+ ( (CD3*EIGL3T)/EIGWR(3)) + ( (C D4*EIGL4T ) / 

2 EI6WR(4))) 

PFLAR (I TAU)=CONST* ( ( (CDl *EIGL5T) /Z1 ) + ( ( CD2* E IGL6T) /Z2) + 

1 ((CD3*EI6L7T)/Z3) + ((CD4*EIGL8T)/Z4)) 

QAR(ITAU)= PFAR(ITAU)-PFLAR(1TAU)*PREEXP(-RLAMBD1*T) 

TIME( IT AU) =T 
T=T+STEP 
150 CONTINUE 
RETURN 
END 
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SUBROUTINE EIGENCEIGA) 

EIGEN CALLS TWO IMSL SUBROUTINES — EIGRF & LEQT2F 
EI6RF COMPUTES EI6ENVALES AND EIGENVECTORS OF 
THE MATRIX E1GA(I,J> 

LEOT2F SOLVES THE LINEAR SYSTEM AX=Y, WHERE 
THE COLUMNS OF A ARE THE EIGENVECTORS OF EIGA 
AND Y IS AN M BY N MATRIX WHOSE COLUMNS ARE THE INDIVI- 
DUAL RIGHT HAND S I DES CNON-HOMOG E NOUS TERMS) 

COMMON /EIGCOM/ EIGSD(4,A^4) ,EIGWR (4) 

DIMENSION UK(24),WKAREA(28),A(4^4),EIGC(4,4),EI6A(4,4) 

COMPLEX k(4)^Z(4^4) 

NEI6 IS THE SIZE OF THE MATRIX WHOSE EIGENVALUES 
WE ARE FINDING 

24<W< DIMENSION) IS OBTAINED BY MULT. NEI6+2 BY NEIG 
28(WKAREA DIMENSION) IS OBTAINED BY EVALUATING (NEIG**2)+3*NEIG 
NEIG=4 
M=4 

IDGT=4 
IJOB=2 
DO 50 J=1^4 
DO 50 1=1,4 
EIGC (I,J )=0- 

50 IF(I.EQ.J) EI6C(I,J)=1. 

CALL EIGRF<EIGA,NEI6,NEI6^IJ08,W,Z,NEI6^WK,IER) 

IF(WK(1) .LT.l .0)PRINT(6,*) "EIGRF PERFORMED WELL,IER =",IER 
IF (WK(1).GE.1.0)PRINT(6,*)"EIGRF PERFORMED S AT IS F A C TOR Y , I E R =",EIR 
IF (WK (1) .6T. 100.0) PRINTC6,*) "EIGRF PERFORMED POORLY, lER =",E1R 
DO 60 1=1, NEIG 
EIGWR(I)=W(I) 

DO 70 J=1,NE1G 
EI6A(I,J)=Z(I,J) 

IF(ABS(EI6A(1,J)) .GT.l.OE-lO) 60 TO 65 
EIGA (I,J)=0.0 
65 A(I,J)=EIGA(I,J) 

70 CONTINUE 
60 CONTINUE 

CALL LEQT2F(A,M,NEIG,NEIG^EIGC,IDGT,U1CAREA,IER) 

DO 80 K=1,NEIG 
DO 80 1=1, NEIG 
DO 80 J=1,NEI6 

C EI6SD(I,J,K) ARE THE CONSTANTS USED TO CONSTRUCT THE 
C PROBABILITY FUNCTIONS P(I/K(T)) - PROBABILITY THAT THE SYSTEM 
C IS IN STATE I AFTER STARTING IN STATE K- 
EI6SD(I,J,K)=EIGA(I,J)*EIGC(J,K) 

C 

80 CONTINUE 
RETURN 
END 
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SUBROUTINE CPLOT (ARTOPLT,X^STEP,GENXPTS,NPTS,LNORLG,ITITLE, 

1 JTITLE) 

Q ■k-ifkikitiftfltitlfic'iiiiikii it-k •kkifkiiiciritifkicitiikitifkickk'kitirit'k-kifkiftfifk'lt-kififkiC'kltir'kik'ifkitifkitifk 

C THIS ROUTINE WOR<S WITH THE DISSPLA PLOTTING PACKAGE. 

Q A******'********'*-*****'*****'********^'*****"*****'^*'*'*******'**^**-******-*'*' 

C NOTE - ARRAYS 'ARTORLT* AND »X* MUST BE OF THE SAME DIMENSION 
C IN THE CALLING ROUTINE. 

DIMENSION ARTOPLT(l),X(l) ,I TITLE (D^JTITLEd) 

LOGICAL GENXPTS^AZR0FLG^XZR0FL6,AEPZFLG 

DATA XAX ISMX/7 .0/,YAXISMX/8.0/^XLEF T/2 .25/,XRI6HT/4 - 75/^ 

1 I YL0WER/6.50/,YUPPER/7.50/,IFRAME/2/,XPOS/2.50/^YPOSl/7.25/i 

2 YPOS2/7.0/,YPOS3/6-75/,AZROFL6/-FALSE./^XZROFLG/.FALSE ./^ 

3 AEPZFLG/. FALSE-/ 

IF (NPTS-EQ.l) 60 TO 25 
K = 0 

ITEST = 1 
lAXSTYP = LNORLG 
IF(.NOT-GENXPTS) 60 TO 15 
DO 10 I=1,NPTS 
10 X(I)=( I-1)*STEP 

15 IF (X (1) .EQ-0-0) XZR0FL6 = .TRUE. 

IF(XZROFLG) X(l) = STEP/10.0 
XMTN=X (1) 

XMAXrX (NPTS) 

YMIN=ARTOPLT< 1) 

YMAX=ART0PLT(1) 

********a****TEST for ARRAY ~ PLOT TYPE COMP AT ABILITY************* 

DO 20 J=1,NPTS 

IF(X(J)-LT.XMIN) XMIN = X(J) 

IF(ARTOPLT(J) .EQ.0.0) K = K+1 

IF( ARTOPLT CJ ) -EQ .0.0) AZROFLG = .TRUE. 

IF(.N0T.(AZR0FL6.AND.((J.EQ.1> .OR.(J .EQ.NPTS)))) GO TO 19 
IF(J.EQ.l) ARTOPLT(J) = ARTOPLT C J +1 ) / 1 0 . 0 
IF (J .EQ.NPTS) ARTOPLT(J) = ARTOPLT (J-1) /lO .0 
YMIN = ARTOPLT(J) 

AZROFLG = .FALSE. 

19 IF (ARTOPLT (J ) -LT. YMIN) YMIN = ARTOPLT(J) 

IFCARTOPLT (J) .GT.YMAX) YMAX = ARTOPLT(J) 

20 CONTINUE 
IF(K.NE.NPTS) GO TO 31 

25 WRITE(6,30) 

30 FORMAT </4X,”ARRA Y TO BE PLOTTED IS IDENTICALLY ZERO; NO PLOT”| 
1 "GENERATED.") 

RETURN 

31 IF( .NOT. AZROFLG) GO TO 33 

WRITE(6,32) 

32 F0RMAT(/4X,"DATA POINT ON LOG AXIS -LE. ZERO? LINEAR", 

1 " AXIS PLOT GENERATED.") 

lAXSTYP = 1 

33 YTEST = (0-05*YMAX) + C0.95*YMIN) 

XTEST = (0.05*XMAX) + (0.95*XMIN) 

NP = NPTS “ 1 

DO 34 I = 1,NP 

IFC(XTEST.6E.X(I))-AND-(XTEST-LE.X(I*1))) ITEST = I+l 

34 CONTINUE 
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IF (ARTOPLT (ITEST) .LE.YTEST) lAXSTYP = ^ 

IFCIAXSTYP .EQ. WRITE(6,35) 

35 F0RMATC/4X, “LINEAR PLOT INADEQUATE; LOG-LOG PLOT USED") 
IF(XZROFLG) WRITE(6,36) XMIN 

36 F0Rf«AT(/4X,"Z ERO VALUE IN TIME ARRAY; XMIN = ",E10-5,“ USED") 
IF(AEPZFLG) WRITE(6^37) YMIN 

37 FORMAT (/4X, "ZERO VALUED END-POINT IN DATA; YMIN = "^ElO-5^ 

1 " USED FOR LOG PLOTS-") 


C 

c*«*********disspla 

c 


CALL COMPRS 
CALL BGNPL(-l) 

CALL NOCHEK 
If(AZROFLG) GO TO 38 

CALL AL6PLT (YMIN, YMAX^ YAXISMX^YORIGL^ YCYCL) 

CALL AL6PLT <XMIN,XMAX,XAXISMX,XORI6L,XCYCL) 

38 CALL AXSPLT (YMIN,YMAX,YAXISMX,YORIG,YSTEP, YAXIS) 
CALL AXSPLT(XMIN,XMAX,XAXISMX,XORIG,XSTEP,XAXIS) 
C 


C ***********LIKEAR PLOT 


IF (lAXST YP-NE .1. AND-IAXSTYP-NE.3) 60 TO 40 

CALL TITLE (ITITLE, 100, JTITLE, 100, "LINEAR Y- A X IS$ ", 1 0 0 , 
1 XAXISMX,YAXISMX) 

CALL FRAME 

CALL BLNK1(XLEFT,XRIGHT,YL0WER,YUPPER,IFRAME) 

CALL 6RAPH(X0RIG,XSTEP,Y0RI6,YST EP) 

CALL GRID(1,2) 

GO TO 50 



40 IF( lAXSTYP. NE. 2. AND-IAXSTYP -NE-3) GO TO 45 

CALL TI TLECITITLE,100, JT ITLE, 100,"LOG Y -AX I S S" , 1 0 0 , 
1 XAXISMX,YAXISMX) 

CALL FRAME 

CALL BLNKl ( XL E F T, XRI6H T, YL OWE R, YUPPE R, I F R AME) 

CALL YL06(X0RI6,XSTEP,Y0RIGL,YCYCL) 

CALL 6R1D(1,1) 

60 TO 50 


C 

C***********L06-L0G PLOT 


C 


C 


45 IF (IAXSTYP-NE-4) GO TO 50 

CALL TITLE (ITITLE, 100, JTITLE, 100 
1 XAXISMX,YAXISMX) 


, "LOG-LOG PLOTS", 100, 


CALL FRAME 

CALL BLNKl (XL EFT,XR I GHT,Y LOWER, YUPPER, I FRAME) 
CALL L06L0G(X0RIGL,XCYCL,Y0RIGL,YCYCL) 

CALL GRID(1,1) 


C 
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50 CONTINUE 
C CALL DASH 

CALL RESETCBLNKl”) 

CALL KESSAGC'CARE III PROJECTS”, lOO^XPOS^YPOSl) 
CALL «ESSA6(”RAYTHE0N COMPANYS",100,XPOS, YP0S2) 
CALL ME S SAG ("SUDBUR Y, MA SSS” , 10 0 , XPO S, Y P0S3) 

C CALL RESET("DASH”) 

CALL CURVE (X,ARTOPLT,NPTS,0) 

CALL ENDPL(O) 

IF(IAXSTYP.NE.3> GO TO 100 
lAXSTYP = 2 
60 TO 40 
100 CONTINUE 
RETURN 
END 
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PROGRAM DFMODL (INPUT ,0UTPUT^TAPE5=I NPUT^TAPE6=0UTPUT, 

1 PLFILE,TAPE4=PLFILE) 

C 

C ************************************************************************* 


C* * 
Q* THIS PROGRAM ANALYTICALLY CALCULATES THE INTERMEDIATE * 
C* DOUBLE FAULT FUNCTION PDF^ FOR COMPARISON WITH CARE III- ♦ 
C * * 


C 

COMMON// DFAR(1800),IDUBAR (AO)^TIME(1800),ITITLE (6) ^JTITLE (6) 
LOGICAL 6ENXPTS, ANOTHER 

C0MM0N/DEI6C0M/ DEI6SD(3^3^3) ^DE IGWR (3) ,DEI6A(3,-3) ,NEIGD, 

1 DEI6IC(3) 

DIMENSION FLTPM(9,2),EVALDF(A^2)^C0EFDF(4,4^2),TBASRC4) 

DATA TBASR/5HHRS ,5HMINS ,5HSECS ,5HMSE C S/ , A NOTHER / - F . / 

C 

C INPUT PARAMETERS 

C 

C THE FAULT TYPE PARAMETERS ARE STORED IN THE ARRAY: FLTPMd^L). 

C 

C I PARAMETER 

C 

C 1 * ALPHA 

C 2 * BETA 

C 3 * DELTA 

C 4 * RHO 

C 5 * EPSILON 

C 6 * PA 

C 7 * PB 

C 8 * C 

C 9 * LAMBDA 

C 

C L PARAMETER 

C 

C 1 * FIRST FAULT TYPE 

C 2 * SECOND FAULT TYPE 

C 

REWIND 4 
WRITE(6,10) 

10 F0RMAT(3X,/^"ENTER FIRST FAULT TYPE PARAMETERS AS FOLLOWS: "^/^ 
16X,”ALPHA1,BETA1,DELTA1^RH01^EPSIL0N1,PA1^PB1^C1'') 

READ(5^*) (FLTPM(I^l), 1=1^8) 

WRITE (6,15) 

15 FORMAT (3X,/, “ENTER SECOND FAULT TYPE PARAMETERS AS FOLLOWS: ”,/, 
16X,*'ALPHA2,BETA2,DELTA2,RH02,EPSIL0N2,PA2,PB2,C2‘') 

READ(5,*) (FLTPM(I,2),I=1,8) 

WRITE(6,20) 

20 FORMAT(/,3X,"TYPE AN INTEGER .LE.4 FOR TIME BASE AS IN CARE3”) 
READ(5,*) ITBASE 
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25 WRITE(6,30) 

30 FORMAT (/,3X^"ENTER ITYP,JTYP.“) 

READ(5,*> ITP^JTP 
WRITE(6,40> 

^0 F0R«AT(/,3X,"TYPE AN INTEGER .LE. 1799 FOR NUMBER OF STEPS") 
READ(5^*) ITSTPS 
WRITE (6,45) 

45 FORMAT (/,3X, "ENTER INITIAL STEP SIZE") 

READC5,*) STEP 
STEPIN = STEP 
WRITE(6,50) 

50 F0RMAT(/,3X, "ENTER DOUBLING ARRAY; DELIMIT WITH COMMAS-”,/) 
READ<5,*) ( IDUBAR(N),N=1,40) 

ITSTPS = ITSTPS + 1 
6ENXPTS = -FALSE- 
INDEX=1 

60 NSTPST=1 

NSTPF=IDUBAR( 1) 

T = 0.0 
C 

C CHOOSE TIME BASE CONVERSION FACTOR 
C 

IF (ANOTHER) 60 TO 76 
TBCF=0-0 

TBASE=TBASR(ITBASE) 

IF (TBASE -EQ -5HHRS ) TBCF=l-0 
IF (TBASE-EQ-5HMINS ) TBCF=60-0 
IF(TBASE.EQ.5HSECS ) TBCF=3600.0 
IF (TBASE. EQ-5HMSECS) TBCF=3.6E6 
IF (TBC F -NE -0.0 ) GO TO 69 
WRITE(6,65) TBASE 

65 FORMAT(/”** ERROR INCORRECT TIME BASE = ",A5) 

STOP 

69 DO 75 L=l,2 

DO 70 1=1,5 

FLTPM(I,L) = FLTPM(I,L) /TBCF 

70 CONTINUE 

75 CONTINUE 

76 CONTINUE 
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C 

C DOUBLE FAULT MATRIX CALCULATIONS 

C 

C EVALDF(I^L)=EI6ENVALUES (L AMBDAl . . .LAMBDA2) 

C COEFDFd^ J,L)=CHARACTERISTIC EQUASION COEFFICIENTS. 

C L~INDEX=INITIAL CONDITION (1 OR 2) 

C J-INDEX=EQUASION A^B,C,OR D (1,2, 3, OR 

C I-INDEX=C0EFFIC1ENT I.E. A1,A2,A3,0R A^ 

C 

C EIGA(I,J) ARE THE ELEMENTS OF THE MATRIX WHOSE 

C EIGENVALUES WE ARE FINDING. 

C 


NEIGD=3 

SET INITIAL CONDITIONS 

DEI6IC (1)=1 
DEI6IC (2)=0 
DEIGIC(3)=0 
DO 90 L=l,2 

DEI6A(l,l)=-( FLTPMCl, JTP) + FLTPM(2,ITP) + FLTPM(4,J TP)+FLTPM (3,JTP) ) 
DEIGA (1,2) = FLTPM(2, JTP) 

DEI6A (1,3) = 0.0 

DEIGA (2,1) = FLTPM(1,JTP) 

DEIGA (2,2)=-(FLTPM (2,ITP)+FLTPM (2,J TP) ) 

DEIGA (2, 3) =FLTPM(1,JTP) 

DEI6A(3,1)=0-0 

DEIGA (3,2)=FLTPM(2,ITP> 

DEIGA (3,3)=-(FLTPM(l, ITP) + FLTPM(2, JTP) + FLTPK(^f,ITP) + FLTPM(3,ITP) ) 
CALL DEI6EN 
DO 85 J=l,3 

EVALDF (J,L)=-DEI6WR(J ) 

DO 80 1=1,3 

IF(L.EQ.l) K = 1 
IF(L.EQ.2) X = 3 
COEFDF(I,J,L)=DEIGSD(J,I,K) 

80 CONTINUE 

85 CONTINUE 

DEIGIC (1)=0 
DEI6IC(3)=1 
90 CONTINUE 

FUNCTYP = 3HPDF 
120 DO 135 I = NSTPST,NSTPF 
DFAR(I) = 0-0 

RHOl = FLTPM(4,ITP) * P R EEX P (- F LT PM ( 4, I T P) * T) 

RH02 = FLTPM(4,JTP> * PR EE XP (^F LTPM ( 4, J TP) * T) 

BETAl = FLTPM(2,ITP) 

BETA2 = FLTPM(2,JTP) 

PA1B2 = 0-0 
PA2B1 = 0.0 
DO 125 N = 1,3 

PA1B2 = (COEFDF (N,3,1)*PREEXP(*“EVALDF(N,1)*T) )+PAlB2 
PA2B1 = (COEFDF (N,1,1)*PREEXP(-EVALDF(N,1)*T))+PA2B1 
125 CONTINUE 

DFAR(I) = ( (BETA2+RH01)*PA1B2) 

1 + ( (BETA1+RH02)*PA2B1) 

TIME(I) = T 
T = T + STEP 
135 CONTINUE 
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INDEX = INDEX + 1 
NSTPST = NSTPF + 1 

NSTPF = NSTPST + IDUBAR (INDEX > • 1 
STEP = STEP * 2 
IF(I .LE. ITSTPS) 60 TO 120 
WRITE (6,1^0) 

l-i»0 F0RMAT(/^3X^*'W0ULD YOU LIKE THIS ARRAY PRINTED AT THE TERMINAL ?") 
READ(5^101> lANSWER 
IF(I ANSWER -NE .IHY) GO TO 155 
WRITE(6,142) FUNCTYP,1TP,JTP 

142 F0RMAT(1H1,/,3X, "FUNCTION ",A3^*' ITYP= ",I2^" JTYP= ”,I2) 

DO 150 I=1^ITSTPS 

WRITE(6,145) I^DF ARC I> ,TIHE(I) 

145 FORMA T(/^3X,I4,5X,E16.10,5X,1PE16- 10) 

150 CONTINUE 
155 CONTINUE 

WRITE(6,160) 

160 F0RMAT(/,3X, "WOULD YOU LIKE THIS FUNCTION PLOTTED ?") 

READ(5,101) lANSWER 
IF (lANSWER.NE.lHY) 60 TO 176 
WRITE (6,165) 

165 FORMAT (/,3X, "ENTER PLOT TYPE: 1 = LINEAR, 2 = LCG, 3=B0TH") 

READ(5,*) LN0RL6 

ENCODE (55, 170, ITITLE) FUNCT YP,I TP, J TP 
170 F0RMATC9HFUNCTI0N ,A5,7H ITYP= ,I3,7H JTYP= ,I3,1H$) 

ENCODE (6 0, 175, J TITLE) STEPIN,TBASE, ITSTPS 

175 F0RMATC26HX AXIS WITH INITIAL XSTEP= ,1PE8-2,A5, 

1 13H PTS PLOTTED=,I4,l H$) 

CALL CPLOT (DFAR,TIME,STEPIN,6ENXPTS,ITSTPS,LN0RLG,ITITLE, JTITLE) 

176 WRITE(6,180) 

180 FORMAT(/,3X, "WOULD YOU LIKE TO COMPUTE ANOTHER FUNCTION?”) 
READ(5,101) lANSWER 

IF(IANSWER.EQ.IHY) ANOTHER = .TRUE. 

IF (lANSWER. EQ-IHY) 60 TO 25 
101 FORMAT(Al) 

190 CONTINUE 

CALL DONEPL 

STOP 

END 

FUNCTION PREEXPCX) 

C 

DATA REALMAX/1 -0E+322/,REALMIN/1.0E-293/,EXPMAX/741 .67/, 

1 EXPMIN/-675.82/ 

C 

IF (X.GT.EXPMIN .AND. X.LT.EXPMAX) GO TO 100 
C SET FUNCTION TO A VALUE VERY CLOSE TO 0-0 BUT NOT EQUAL TO 0.0 
IF (X.LE. EXPMIN) PREEXP = REALMIN 
C SET FUNCTION TO THE MAXIMUM VALUE THE CDC CAN HANDLE 
IF (X.6E -EXPMAX) PREEXP = REALMAX 
GO TO 200 

100 PREEXP = EXP(X) 

200 RETURN 

FND 
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SUBROUTINE DEIGEN 

DEIGEN CALLS TWO IMSL SUBROUTINES — EIGRF & LEQT2F 
EI6RF COMPUTES EIGENVALES AND EIGENVECTORS OF 
THE MATRIX EI6A(I,J) 

LEQT2F SOLVES THE LINEAR SYSTEM AX=Y, WHERE 
THE COLUMNS OF A ARE THE EIGENVECTORS OF EIGA 
AND Y IS AN M BY N MATRIX WHOSE COLUMNS ARE THE INDIVI- 
DUAL RIGHT HAND SIDES (NON-HOMOGENOUS TERMS) 

COMMON/DEIGCOM/ E I 6SD ( 3, 3, 3) , EI6WR(3) ,EIGA(3^3) ,NEIG,EIGIC<3) 
DIMENSION WK(15),WKAREAC18),A(3,3),EIGC(3,3) 

COMPLEX W(3),Z<3^3) 

NEI6 IS THE SIZE OF THE MATRIX WHOSE EIGENVALUES 
WE ARE FINDING 

15<WX DIMENSION) IS OBTAINED RY MULT- NEIG+2 BY NEIG 
18CWKAREA DIMENSION) IS OBTAINED BY EVALUATING (N E I G * *2 ) +3 *N E I G 
M=NE16 
IDGT = 4 
IJOB=2 

DO 50 J:^1,NEIG 
DO 50 I=1^NEIG 
EIGC( I,J)=0- 

50 IF(I-EQ-J) E1GC(I,J)=1. 

DO 55 1=1, NEIG 

EI6C (I,1)=EIGIC(I) 

55 CONTINUE 

CALL EIGRF(EIGA,NEIG,(VEIG,IJ0B,W,Z,NEI6,WK,IER) 

IF(WK(1) -LT.1-0)PRINT(6,*) "EIGRF PERFORMED WELL,IER =",IER 
IF(WK(1) .GE.1.0)PRINT(6,*)"EI6RF PERFORMED SATISFACTORILY, =", 
HER 

IF(WK(1) -GT.100-0)PRINT(6,*) "EIGRF PERFORMED POORLY, lER =",IER 
DO 60 1=1, NEIG 
EIGWR(I)=W(I) 

DO 70 J=1,NEI6 
EIGA(I,J) = Z(I,J) 

IF(ABS(EIGA(I,J)).GT.1.0E-10) GO TO 65 
EI6A(I,J)=0.0 
65 ACI, J) =EI6A(I,J) 

70 CONTINUE 
60 CONTINUE 

CALL LEQT2F {A,M,NEIG,NEI6,EIGC,IDGT,WICAREA,IER) 

DO 80 K=1,NEIG 
DO. 80 1 = 1, NEIG 
DO 80 J=1,NEIG 

C EIGSD(I,J,K) ARE THE CONSTANTS USED TO CONSTRUCT THE 
C PROBABILITY FUNCTIONS P(I/K(T)) - PROBABILITY THAT THE SYSTEM 
C IS IN STATE I AFTER STARTING IN STATE K. 

EIGSD(I,J,K)=E1GA(I,J)*EI6C( J,K) 

C 

C 

80 CONTINUE 
RETURN 
END 
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SUBROUTINE CPLOK ARTOPLT^X, STEP^GENXPTS^NPTS^LNORLG^ITITLE, 

1 JTITLE) 

Q itie -k-kitit kkiekitlfliikkitkltk-kifk-k-klkkifttkitk'kkifkkitiflfkiritii'kieitkitkk'klc'kit 

C THIS ROUTINE WORKS WITH THE DISSPLA PLOTTING PACKAGE- 

C kk-kk-kkkkkkk-k-k-kkirkkk'kkkkk ***-k***k*k*k***it ************ a******** ******** 

C NOTE - ARRAYS ‘ARTOPLT* AND »X* MUST BE OF THE SAME DIMENSION 
C IN THE CALLING ROUTINE. 

DIMENSION ARTOPLT(l),X(l) ^ITITLECl), JTITLE (1) 

LOGICAL GENXPTS^AZROFLG^XZROFLG, AEPZFLG 

DATA XAXISMX/7.0/,YAXISMX/8.0/^XLEFT/2.25/^XRIGHT/4.75/^ 

1 YLOWER/6-50/,YUPPER/7.50/,IFRAME/2/,XPOS/2 .50/, YPOSl/7.25/^ 

2 YPOS2/7.0/,YPOS3/6.75/,AZROFLG/.FALSE ./,XZR0F LG/. FALSE-/, 

3 AEPZFL6/. FALSE -/ 

IFTNPTS- EG. 1) 60 TO 25 
K = 0 

ITEST = 1 
lAXSTYP = LN0RL6 
IF(.N0T-6ENXPTS> 60 TO 15 
DO 10 I=1,NPTS 
10 X(I) =(I-1)*STEP 

15 IF(X(1) .EQ.0.0) XZR0FL6 = .TRUE. 

IF(XZROFLG) X(l) = STEP/10.0 
XMIN=X(1 > 

XMAX = X (NPTS) 

YMIN=ART0PLT (1) 

YMAXrARTOPLTd) 

C 

C*************T EST FOR ARRAY - PLOT TYPE COMPATABILITY************* 

C 

DO 20 J=1,NPTS 

IF(X( J) .LT .XMIN) XMIN = X(J) 

IF (ARtOPLT(J).EQ.O.O) K = K+1 
IF (ARTOPLT(J).EQ.O.O) AZROFLG = .TRUE. 

IF ( .NOT . (AZROFLG -AND . < (J .EQ.l) -OR. ( J .EQ.KPTS) ) ) ) 60 TO 19 
IF(J.EQ.l) ARTOPLT(J) = ARTOPLT (J +D/10 . 0 
IFC J -EQ.NPTS) ARTOPLTCJ) = ART OPLT < J -1 ) / 1 0 . 0 
YMIN = ARTOPLT(J) 

AZROFLG = -FALSE. 

19 IF (ARTOPLTCJ) -LT. YMIN) YMIN = ARTOPLT(J) 

IF (ARTOPLT (J> -GT-YMAX) YMAX = ARTOPLTCJ) 

20 CONTINUE 

IF(K.NE.NPTS) GO TO 31 
25 WRITE(6,30) 

30 FORMAT(/AX, "ARRAY TO BE PLOTTED IS IDENTICALLY ZERO; NO PLOT", 
1 "GENERATED.*') 

RETURN 
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31 IF(-NOT-AZROFLG) 60 TO 33 

yRITE (6^32) 

32 F0RMAT(/4X,”DATA POINT ON LOG AXIS -LE. ZERO; LINEAR'^ 

1 *' AXIS PLOT GENERATED.") 

lAXSTYP = 1 

33 YTEST = (0-05*YMAX) + (O.gS^^YMIN) 

XTEST = <0.05*XMAX) + (0-95*XMIN) 

NP = NPTS - 1 

DO 34 I = l^NP 

IF((XTEST.GE.X(I)>. AND. (XTEST. LE.X(I + 1))) ITEST = I + l 

34 CONTINUE 

IFCARTOPLK ITEST) .LE. YTEST) lAXSTYP = 4 
IFCIAXSTYP .EQ. 4) WRITE(6,35) 

35 F0RMAT</4X, "LINEAR PLOT INADEQUATE; LOG-LOG PLOT USED”) 
IF(XZROFLG) WRITE(6,36) XHIN 

36 FORMAT (/4X^"ZER0 VALUE IN TIME ARRAY; XHIN = "^EIO.5^" USED") 
IFCAEPZFLG) WRITE(6,37> YMIN 

37 F0RMAT(/4X^"Z ERO VALUED END-POiNT IN DATA; YMIN = ",E10.5^ 

1 " USED FOR LOG PLOTS.") 

C 

C 

CALL COMPRS 
CALL BGNPL(-l) 

CALL NOCHEK 
IF(AZROFLG) GO TO 38 

CALL ALGPLT(YMIN,YMAX,Y AXISMX ^Y OR I GL , Y C Y CL ) 

CALL ALGPLT(XMIN,XMAX,XAXlSMX,XORIGL,XCYCL> 

38 CALL AXSPLT(YMIN,YMAX,YAXISMX,Y0RIG,YSTEP,YAXIS) 

CALL AXSPLT (XMlN,XMAX,XAXISMX,XORIG>XSTEP^XAXIS) 

C 

C 

IFCIAXSTYP. NE.l. AND. lAXSTYP. NE. 3) 60 TO 40 

CALL TITLE(ITITLE^100,JTITLE^100, "LINEAR Y -A X ISS " , 1 0 0 , 

1 XAXISMX, YAXISMX) 

CALL FRAME 

CALL BLNKl (XLE F T, XRI GHT ^ YLOWE R ^ YUPPE R ^ I F R AME ) 

CALL GRAPH<X0RI6,XSTEP,Y0RIG^YSTEP) 

CALL 6RID(1,2) 

GO TO 50 


C *********** SEMI-LOG PLOT 
C 

40 IF (lAXST YPi,NE .2.AND .1AXSTYP.NE.3) 60 TO 45 

CALL TITLE (ITITLE ,100, JTITLE, 100, "LOG Y“AXIS$",100, 
1 XAXISMX,YAXISMX) 

CALL FRAME 

CALL BLNKl (XLEFT,X R16HT,Y LOW ER,YUPPER,I FRAME) 

CALL YL06(X0RIG,XSTEP,Y0RIGL,YCYCL) 

CALL 6RI0(1,1) 

GO TO 50 
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o o o 


C 

plot routine**********************************^ 

c 

45 IF( lAXST YP.NE.4') GO TO 50 

CALL TITLE(ITITLE^100,JTITLE^100^''LOG-L06 PLOTS”, 100^ 

1 XAXISMX,YAX1SMX) 

CALL FRAME 

CALL BLNKl ( XLE F T , XRIGHT, YLOWE R, YUPPE R, I F R AME ) 

CALL L06L06 (X0RI6L,XC YCL,yORIGL,YCYCL) 

CALL GRI0(1,1) 

“k-k kkkkkkkifk'kk-kkkiiitkkitkkiflUfliik'kitick'kitkkk-kick'ltitk'k'kkkitiiif 

50 CONTINUE 
C CALL DASH 

CALL RESET (“BLNKl”) 

CALL MESSAG(”CARE III PROJECTS”, 100, XPOS, YPOSl) 

CALL MESSA6 ("RAYTHEON COMP AN YS” ,10 0 , XPO S , YPO S2 ) 

CALL MESSA6("SUDBURY,MASSS",100,XPOS,YPOS3) 

C CALL RESETC'DASH") 

CALL CURVE(X,ARTOPLT,NPTS,0) 

CALL ENDPL(O) 

IF (lAXST YP.NE .3) GO TO 100 
lAXSTYP - 2 
GO TO 40 
100 CONTINUE 
RETURN 
END 
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APPENDIX 2 


Execution Field Lengths 


PROGRAM FIELD LENGTH (Octal) 

CARE IN 154000 

COVRGE 163700 

CARE3 157200 

CVGPLT 127600 

RELPLT 076000 
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APPENDIX 3 


Selected Test Cases 




THE FOLLOWING ARE THE CAREIII INPUT FILES 
FOR THE SELECT TEST CASES REPORTED ON. 


$FLTTYP ALP=O.^BET=O.^DEL=3.6E3,RHO=3.6E4^EPS=3.6E5,IEPSF=1,IDELF=1, 
CVPLOT=-T-^IAXSCV=3,C=1-O^CVPRNT=.T.S 
$STAGES N0P=3^2,N=4,M=2j,IRLPCD=3,RLPL0T=.T ,,IAXSRL = 3$ 

SFLTCAT OMG=1.0,RLM=1.0E-5 S 

SRNTIME FT=60.^ ITBASE=2,SYSFLG=.T.^CPLFLG=.T.,NSTEPS=64t 
***TEST CASE-TIA S. NEUMANN 23FEB82*** 

112 2 
2 0 1 

CRITICAL-FAULT TREE 

14 5 5 

114 

5 2 1 2 3 4 


SFLTTYP ALP=3.6E2^BET=0.^DEL=0.0,RHO=3-6E4,EPS=3-6E5,IEPSF=l,IDELF=l, 
CVPLOT^.T .,I AXSCV=4 ,C = 1-0,C VPRNT=. T., DBLDF = .06J: 

SSTAGES N0P=3^2^N=4^M=2^IRLPCD=3^RLPL0T=.T.,IAXSRL=4$ 

SFLTCAT 0M6=1 .0,RLM=1.0E-5 S 

SRNTIME FT = 60-,ITBASE=2,SYSFLG = .T.,CPLFLG=:.T.,NSTEPS=64S 
***TEST CASE-T2C S. NEUMANN 24FEB82*** 

112 2 
2 0 1 

CRITICAL-FAULT TREE 

14 5 5 

114 

5 2 1 2 3 4 


SFLTTYP ALP=3.6E6,BET=3.6E6^DEL=3.GE4^RH0=3.6E3,EPS=3.6E4,IEPSF=1, 
IDELF=2,CVPLCT=-T-,IAXSCV=4,C=1.0,CVPRNT=.T.,DBLDF=.02$ 

SSTAGES NOP=3,2^N=4^M=2^1RLPCO=3,RLPLOT=-T.^ I AXSRL=4S 
SFLTCAT 0MG=1 . 0,RLM=1 .OE-5 S 

SRNTIME FT=60-,ITBASE=2^SYSFL6=.T.,CPLFLG=.T.^NSTEPS=64S 
♦★★TEST CASE-T3B* S. NEUMANN 24FEB82*** 

112 2 
2 0 1 

CRITICAL-FAULT TREE 

14 5 5 

114 

5 2 1 2 3 4 


SFLTTYP ALP=3.£E3,BET=3.6E6^DEL=0 .0,RHO=3.6E3,EPS=3-6E4^IEPSF=1,IDELF=1, 
CVPLOT=.T.,IAXSCV=3,C=1.0^CVPRNT=.T.,TRUNC=1.0E-6S 
SSTAGES N0P=3,2,.N=4,M=2,IRLPCD = 3^RLPL0T = .T .,IAXSRL = 3S 
SFLTCAT OMG=1.0,RLM=1.0E-5 S 

SRNTIME FT=60.^ITBASE=2,SYSFLG=.T.^CPLFLG=.T.^NSTEPS=64S 
♦♦♦TEST CASE-T3C S. NEUMANN 02MAR82^** 

112 2 
2 0 1 

CRITICAL-FAULT TREE 

14 5 5 

114 

5 2 1 2 3 4 
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SFLTTYP ALP = 3.6E6.,BET=:3-6E3,DEL=3-6E4^RH0=3-6E3,EPS=3-6E4^IEPSF=1, 
IDELF=2^CVPL0T=.T .^IAXSCV=4,C=1 ,0,0 VPRNT=. T.,DBLDF=0.02S 
SSTA6ES NOP=3^2^N=A^M=2^IRLPCD=3,RLPLOT=.T.^IAXSRL=AS 
SFLTCAT OM6=1.0,RLM=1.0E-5 $ 

SRNTIME FT=60 .,ITBASE=2,SYS FL6 = -T -,CPLFLG = .T .,NSTEPS = 64$ 

♦★★TEST CASE-T3D* S.NEUf^ANN 1KAR82*** 

112 2 
2 0 1 

CRITICAL-FAULT TREE 

14 5 5 

114 

5 2 1 2 3 4 


SFLTTYP ALF=2^3.6E3,BET=2^3.&E3,DEL=2^3.6E3^RH0=2*3-6E4,EPS=2*3-6E5, 
NFTYPS=2,IEPSF=2*1^IDELF=2* 1,CVPL0T=.T., I AXSCV=3,C=1.0,CVPRNT=.T., 
PA=1.0,0.9,PB=0-0,0-l S 

T.STAGES N0P = 3,2,N=4 ^W = 2^IRLPCD = 3,RLPL0T = ,T.^IAXSRL = 3$ 

SFLTCAT 0«G=1.0,RLM=1.0E-5 $ 

SRNTIME FTr60.,ITBASE = 2,SYSFLG=.T. PLFL6= . T . ,NSTEPS = 64S 
★★★TEST CASE-T4A S. NEUMANN 03MAR82^*^ 

112 2 
2 0 1 

CRITICAL-FAULT TREE 

14 5 5 

114 

5 2 1 2 3 4 


SFLTTYP ALP=5-6E3,3,GE6,BET=2*3.6E3,DEL = 2*0.0,RHO = 2*3-6E3,EPS = 2^3 .6E4, 
NFTYPS = 2,IEPSF=2^1,IDELF=2*1,CVPL0T = .T .^1AXSCV = 3,C = 1 .0,CVPRNT=.T 
PA=2*1 .0,PB=2*0 .0 $ 

SSTAGES N0P=3,2,N=4,M=2^1RLPCD=3,RLPL0T=. T.^1AXSRL=3$ 

SFLTCAT 0«6=1 .0,RLM=1.0E-5 S 

SRNTIME FT=60.,ITBASE=2,SYSFLG=.T.,CPLFLG=.T.,NSTEPS=64$ 

★★★TEST CASE-T4B S. NEUMANN 02MAR82*^^ 

112 2 
2 0 1 

CRITICAL-FAULT TREE 

14 5 5 

114 

5 2 1 2 3 4 
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APPENDIX 4 
Coverage Functions 
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Single-Fault Model Equations 


FUNCTION 


♦ (t) 


P,(t) 


PfcCt) 




* t HERE IS 


MATHEMATICAL EXPRESSION* 


DEFINITION 


(T)d(T)dT 

Jo 


times the probability 

INTENSITY OF RE-ENTERING 
STATE A EXACTLY t TIME 
UNITS AFTER THE PREVIOUS 
ENTRY 


r 

JO 


/V +• 

e" r(t)d(t) + 3 \ (Ji(t-T)P (T)dx 

a 


PROBABILITY OF BEING IN 
STATE A AT TIME t WHEN 


4>(t) + 3 



(i)dT 


PROBABILITY OF BEING IN 
STATE B AT TIME t WHEN 


rt PROBABILITY OF BEING IN 

e p(T)d(T)e(t-T)dT + 6 j <J>(t-T)P^(x) dx STATE A^ OR AT TIME t 

WHEN ^ 


MEASURE OF THE TIME SINCE THE ENTRY INTO STATE A. 


Single-Fault Model Equations (Continued) 


FUNCTION 


Pe<t) 


Pe«t) 


Pf(t) 




MATHEMATICAL EXPRESSION* 


DEFINITION 


e'“S(t)d(t) + e 


e~“*^«(t)r(t) + B 



<j)(t-T)p^{T)dT 


4»(t-T)p-(T)dT 


INTENSITY OF ENTRY INTO 
STATE AT TIME t WHEN 

P P = 1 
A B 

INTENSITY OF ENTRY INTO 
STATE Ajj FROM STATE A AT 
TIME t WHEN ^ 


( 1-0 



p (T)E(t-T)dT 

e 


INTENSITY OF ENTRY INTO 
STATE F AT TIME t WHEN 




ae 


-(a+e) (t-x) 
" a+ 3 


) 


di + p~(t) 
e 


INTENSITY OF ENTRY INTO 
STATE Ajj AT TIME t poR 
THE FIRST TIME 


* 


t HERE IS A MEASURE OF THE TIME SINCE THE ENTRY INTO STATE A 
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Single-Fault Model Equations (Continued) 


FUNCTION MATHEMATICAL EXPRESSION* 


DEFINITION 


TflCt) 


Xg(t) 





)e (t-T)dT 


INTENSITY OF ENTRY INTO 
STATE Bq AT TIME t FOR 
THE FIRST TIME 





PROBABILITY OF HAVING 
ENTERED STATE B^ FOR THE 
FIRST TIME AND THEN RE- 
MAINING IN THE BENIGN 
STATE UNTIL TIME t 



(t) 



x)dT + Pg 



Yg(T)dT 


PROBABILITY THAT A FAULT 
HAS BEEN DIAGNOSED AS 
PERMANENT BY TIME t 


p^(t) 


F^(t) + 



(1-P^»\(t-T) + (l-Pg)eXB<t-T)lPjj(T)dT 


* t HERE IS A MEASURE OF THE TIME SINCE THE ENTRY INTO STATE A. 


FUNCTION RELATING PROB- 
ABILITIES AND INTENSITIES 
DERIVED WHEN ° ^ TO 

THOSE SAME QUANTITIES WHEN 

Pa ® are arbitrary 
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FUNCTION MATHEMATICAL EXPRESSION* DEFINITION 


Fjj(t) With F^lt) = Pjj(t> + Xg(t) PROBABILITY OF BEING IN 

STATE B AT TIME t 

Fg(t) Pjj(t) with Fjj(t) = P^(t) + P^(t) PROBABILITY OF BEING IN 

A NON -BENIGN STATE AT 
TIME t 

Pj^(t) + Xg(t) 

+ P^(t) + P^(t) 

CL 6 

PERMANENT FAULTS 

P,(t) + P„(t) 

TRANSIENT FAULTS 

^DP**^* *’x^*^* PROBABILITY THAT A FAULT 

HAS BEEN DIAGNOSED AS 
PERMANENT BY TIME t 

* tHERE IS A MEASURE OF THE TIME SINCE THE ENTRY INTO STATE A, 



I 

I 

PROBABILITY OF A LATENT 
FAULT OR UNDETECTED ERROR 
AT TIME t 



159 


Double-Fault Model 


FUNCTION MATHEMATICAL EXPRESSION 

c^(t) $^(t)dj(t)r^(t)aj(t) + 

i • If 2 U-P* )b. (t) 6. (t)r . (t)a. (t) + 

Aj 1 3 3 J 

j - 3-i b^(t)d^ (t)pj (t)a^ (t) 

a^(t)b^(t)d^(t)r^(t) 

i « 1,2 
j - 3-1 

c^(t) ^ ICj^(t-T)32(T)bj^(T) + 

CjCt-T) $^(T)b2(x)]dT 

CjCt) ( tfi(t-T)B2(T)bj(T) + 

f^Ct-T) 3j^(x)b2(T) ]dx 


I 


uations 


DEFINITION 


TRANSITION RATE FROM 
STATE A jB.i TO STATE F 


TRANSITION RATE FROM 
STATE AjBi TO STATE 


INTENSITY OF ENTRY INTO 
STATE F t TIMEUNITS AFTER 
ENTRY INTO STATE B1B2 


INTENSITY OF RE-ENTRY 
INTO STATE B1B2 t TIME 
UNITS AFTER A PREVIOUS 
ENTRY 
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Equationsf Conti tiued 


DEFINITION 


INTENSITY OF ENTRY INTO 
STATE t TIME UNITS 

AFTER ENTRY INTO STATE 

INTENSITY OF ENTRY INTO 
STATE F t TIME UNITS 
AFTER ENTRY INTO STATE 

* 2®1 
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